CVE-2020-10251: 
ImageMagick vulnerability analysis and mitigation

CVE-2020-10251 is an out-of-bounds read vulnerability discovered in ImageMagick version 7.0.9. The vulnerability exists within the ReadHEICImageByID function in coders\heic.c. The issue was disclosed on March 10, 2020, affecting ImageMagick software installations (NVD, GitHub Issue).

The vulnerability occurs when processing HEIC image files where the width or height value exceeds the actual size of the image. This triggers an out-of-bounds read condition in the ReadHEICImageByID function. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local access is required and user interaction is needed (NVD).

When exploited, this vulnerability can lead to an out-of-bounds read condition, which may result in a denial of service through application crashes. The vulnerability has been classified as CWE-125 (Out-of-bounds Read) (NVD).

Users should update to a version of ImageMagick newer than 7.0.9 where this vulnerability has been addressed. The Debian security team has noted that this advisory is not relevant for Debian 10 installations (Snyk).